@bongos/core 1.19.1073 → 1.19.1075

package/src/bongos/api-errors.js

@@ -61,7 +61,7 @@ const OVERRIDES = Object.freeze({
   unauthenticated: 'unauthenticated',
   cookie_required: 'unauthenticated',
   unknown_or_expired: 'unauthenticated',
-  box_scope: 'forbidden',
+  session_scope: 'forbidden',
 
   // --- forbidden: 403 (rank/ownership, not "missing" or "bad input") ---
   forbidden: 'forbidden',

package/src/bongos/api-prefix.js

@@ -9,10 +9,10 @@
 //
 // The URL rename (Part B / B1, task 1919) flipped the canonical here: the API is
 // now served at '/api/bongos', and '/api/gds' stays mounted FOREVER as a silent
-// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped Dev Box desktop
-// binaries, the separately-hosted status-dashboard mirror, and live dev boxes all
-// call '/api/gds' and can't be force-updated. serve-internal.js mounts the router
-// + discovery index at API_PREFIX and every LEGACY_API_PREFIXES entry.
+// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped older CLI
+// releases and the separately-hosted status-dashboard mirror all call '/api/gds'
+// and can't be force-updated. serve-internal.js mounts the router + discovery
+// index at API_PREFIX and every LEGACY_API_PREFIXES entry.
 const API_PREFIX = '/api/bongos';
 
 // Prefixes the server ALSO answers on, for callers pinned to the previous path.

package/src/bongos/auth-github.js

@@ -253,9 +253,8 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // Approval gate (2026-05-30): the web hall sign-in no longer admits anyone
   // with a GitHub account. A first-time visitor must have been approved by an
   // Archon (their access_request marked 'invited') before a builder row is
-  // created. This Archon approval is the ONLY gate — newcomers build on hosted
-  // dev boxes, so there is no GitHub repo-access / collaborator check anywhere
-  // (2026-06-07). Established builders (a row already exists for this github_id)
+  // created. This Archon approval is the ONLY gate sign-in applies — there is
+  // no GitHub repo-access / collaborator check in it (2026-06-07). Established builders (a row already exists for this github_id)
   // always pass — this only blocks NEW first-time entries.
   //
   // SR-19 / task #1000 (2026-06-13): the CLI device flow (pollDeviceFlow,

package/src/bongos/auth.js

@@ -128,47 +128,35 @@ async function resolveSession(req) {
   return resolved;
 }
 
-// ── SESSION-SCOPES — capability attached to the TOKEN (BV1.R99, ADR 0151 §3) ──
-//
-// A session's SCOPE is orthogonal to its builder's roles: a dev-box session
-// (source='box') is baked onto a machine OUTSIDE the ADR 0016 trust boundary
-// (#919/SR#2, ADR 0053), so it must stay limited even when its builder is an
-// Archon. Before R99 that was an ad-hoc boolean (`req.allowBoxScope`) plus a
-// hardcoded `source === 'box'` test; it is now an explicit, declared model.
-//
-// A SESSION-SCOPE CAN ONLY EVER NARROW. Effective authority is (what the builder's
-// roles confer) ∩ (what this session's scope allows), with the allow-list
-// DENY-BY-DEFAULT. The governance resolver COMPOSES that intersection
-// (resolveSessionPermissions), but nothing on the request path reads it — it is
-// exported on the `government` port and exercised by
-// tests/government_session_scope.mjs, and that is the whole of its live use. The
-// ENFORCEMENT is the kernel's own route-reachability projection below: "is this
-// route inside the session's scope at all", run by requireBuilder and by
-// runPageGate. This comment used to say the permission gates read the resolver's
-// composed answer; they never have, and the next reviewer should not lose an hour
-// to that ghost (task 1003197 (B)). The projection is deliberately the ROLE-FREE
-// half — folding the builder's roles in here would change who can reach the
-// bootstrap routes (a builder on a rank with no seeded governance role resolves to
-// zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
-// a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
-//
-// GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
-// governance-owned data in modules/government/session-scopes.json, validated
-// against the permission catalog at load by modules/government/session-scopes.js.
-// Core reads it as DATA with fs — never `require` (ADR 0083's one-way rule: a
-// module's code and enable/disable state must never be something the kernel
-// depends on). The sibling trust primitive permission-path-check.js reads the
-// protected-surface registry exactly this way (R101). Reading it statically rather
-// than through the `governance` kernel port is the deliberate call: a request must
-// not need a module to be mounted to stay deny-by-default, and the alternative
-// fails badly in both directions — denying on an absent port would take every
-// cli/web session down, admitting would hand a box token full authority.
+// ── SESSION SOURCES — which kinds of token may authenticate at all (BV1.R99) ──
+//
+// Every builder_sessions row carries a `source` saying where it was minted. The
+// session-scope registry (modules/government/session-scopes.json) DECLARES the
+// sources this instance accepts; a session whose source it does not declare is
+// DENIED — by requireBuilder on every route and by runPageGate on every page —
+// rather than defaulting to its builder's full authority. A null/absent source is
+// a DECLARED row (sessions minted before migration 090 added the column), not an
+// implicit default.
+//
+// Every declared source is UNSCOPED: it carries its builder's full rank authority.
+// The registry used to be able to declare a NARROWING scope too — a
+// deny-by-default allow-list for a token living outside the ADR 0016 trust
+// boundary — and its only user was a machine-baked token (ADR 0053) that goal
+// 1000120 retired. With no other narrowing scope the allow-list machinery went
+// with it (task 1003894). The parser therefore REFUSES a row that declares an
+// allow-list: without the enforcement behind it, such a row would read as a
+// restriction while granting full authority. A session row still carrying a
+// retired source simply fails the "declared?" test and is denied.
+//
+// GOVERNANCE OWNS THE LIST, THE KERNEL STAYS THE ENFORCER. Core reads the registry
+// as DATA with fs — never `require` (ADR 0083's one-way rule: a module's code and
+// enable/disable state must never be something the kernel depends on), exactly as
+// permission-path-check.js reads the protected-surface registry (R101). A request
+// must not need a module mounted to stay fail-closed: denying on an absent port
+// would take every cli/web session down.
 //
 // FAIL-CLOSED both ways: an unreadable or malformed registry THROWS (it never
-// degrades to "every session is unscoped"), and a session whose `source` the
-// registry does not declare is DENIED rather than defaulting to full authority. A
-// null/absent source is a DECLARED row (rows minted before migration 090 added the
-// column, which predate the 'box' source existing), not an implicit default.
+// degrades to "every source is accepted"), and an undeclared source is denied.
 const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'session-scopes.json');
 
 // Pure: validate + normalize the parsed registry. Split from the file read so the
@@ -177,31 +165,21 @@ const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules',
 function parseSessionScopes(raw, label = 'session-scope registry') {
   const rows = Array.isArray(raw && raw.scopes) ? raw.scopes : null;
   if (!rows || rows.length === 0) {
-    throw new Error(`${label} declares no session scopes. Refusing to run with no session-scope model (ADR 0053/0151).`);
+    throw new Error(`${label} declares no session sources. Refusing to run with no session-source model (ADR 0151).`);
   }
   const bySource = new Map();
   for (const row of rows) {
     const source = row && row.source !== undefined ? row.source : null;
     if (source !== null && (typeof source !== 'string' || !source)) {
-      throw new Error(`${label}: every scope needs a non-empty session source string, or null for the legacy sourceless row`);
+      throw new Error(`${label}: every row needs a non-empty session source string, or null for the legacy sourceless row`);
     }
     if (bySource.has(source)) throw new Error(`${label}: duplicate session source "${source}"`);
-    const unscoped = !!(row && row.unscoped === true);
-    const permissions = row && Array.isArray(row.permissions) ? [...row.permissions] : [];
-    // unscoped XOR an allow-list. Both would be ambiguous (does it narrow?);
-    // neither would be a scope that can never admit anything — an authoring slip
-    // either way, and both must fail loud rather than pick a default.
-    if (unscoped === (permissions.length > 0)) {
-      throw new Error(`${label}: "${source}" must declare EITHER unscoped:true OR a non-empty permissions allow-list, never both/neither`);
-    }
-    if (permissions.some((key) => typeof key !== 'string' || !key)) {
-      throw new Error(`${label}: "${source}" lists a non-string permission key`);
+    if (row && (row.permissions !== undefined || row.unscoped !== undefined)) {
+      throw new Error(`${label}: "${source}" declares a scope (permissions/unscoped). Narrowing session scopes were removed (task 1003894); a row may only declare a source that carries its builder's full authority.`);
     }
     bySource.set(source, Object.freeze({
       source,
       label: row && typeof row.label === 'string' ? row.label : null,
-      unscoped,
-      permissions: Object.freeze(permissions),
     }));
   }
   return bySource;
@@ -212,7 +190,7 @@ function loadSessionScopes(file) {
   try {
     raw = JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch (e) {
-    throw new Error(`session-scope registry unreadable at ${file}: ${e.message}. Refusing to run with no session-scope model (ADR 0053/0151).`);
+    throw new Error(`session-scope registry unreadable at ${file}: ${e.message}. Refusing to run with no session-source model (ADR 0151).`);
   }
   return parseSessionScopes(raw, `session-scope registry ${file}`);
 }
@@ -220,7 +198,7 @@ function loadSessionScopes(file) {
 const _sessionScopes = loadSessionScopes(SESSION_SCOPE_REGISTRY_PATH);
 const SESSION_SCOPES = Object.freeze([..._sessionScopes.values()]);
 
-// The scope a session's `source` declares, or null when the registry does not
+// The declared row for a session's `source`, or null when the registry does not
 // declare it (⇒ deny; never "full").
 function sessionScopeFor(source) {
   const key = source === undefined ? null : source;
@@ -228,39 +206,6 @@ function sessionScopeFor(source) {
   return _sessionScopes.get(key) || null;
 }
 
-// Route reachability, deny-by-default. An unscoped session reaches everything its
-// builder's gates admit; a SCOPED session reaches only a route that declared
-// capability its allow-list names — so a route that declares nothing (every route
-// that has not opted in, including any added later) is out of reach.
-function scopeCovers(scope, declared) {
-  if (!scope) return false; // unrecognised source
-  if (scope.unscoped) return true;
-  const needs = Array.isArray(declared) ? declared : [];
-  return needs.length > 0 && needs.every((key) => scope.permissions.includes(key));
-}
-function sessionScopeAdmits(source, declared) {
-  return scopeCovers(sessionScopeFor(source), declared);
-}
-
-// The route-side DECLARATION: "reaching this route needs these capabilities from
-// the session's scope." Mount it BEFORE requireBuilder. Inert for an unscoped
-// session — requireBuilder compares the declaration only against a narrowing scope.
-function sessionScope(...keys) {
-  const needs = Object.freeze([...keys]);
-  return function declareSessionScope(req, _res, next) {
-    req.sessionScopeNeeds = needs;
-    next();
-  };
-}
-
-// The dev-box bootstrap declaration (#919) — the name modules/dev-box mounts
-// through the plugin API (docs/modules-contract.md 1.2.0), kept as the module-
-// facing spelling. It is no longer a bare boolean: it declares the box scope's OWN
-// allow-list, read from the registry, so the declaration cannot drift from the
-// scope it declares. If the registry stopped declaring a box scope it would
-// declare nothing and every box session would be denied — fail closed.
-const allowBoxScope = sessionScope(...((sessionScopeFor('box') || { permissions: [] }).permissions));
-
 async function requireBuilder(req, res, next) {
   let session;
   try {
@@ -295,24 +240,13 @@ async function requireBuilder(req, res, next) {
     res.fail('builder_inactive', 403);
     return;
   }
-  // SECURITY (#919, SR#2): SESSION-SCOPE, deny-by-default. The dev-box provisioner
-  // (scripts/gds/box.js) bakes a session into cloud-init so the box can bootstrap
-  // (#818 — box-source-fetch clones the rank-scoped repo before /builder-setup
-  // exists). That token lives ON the box, which is OUTSIDE the ADR 0016 trust
-  // boundary, so it must NOT carry the builder's full authority. Since R99 the rule
-  // is DATA (the session-scope registry above), not a hardcoded source test: a
-  // narrowing session reaches ONLY a route that declared capability its allow-list
-  // names, so EVERY other route (all of /tasks, /me, the rest of /box …) fails
-  // closed here, including any route added later; and a source the registry does not
-  // declare at all is denied rather than treated as unscoped. A builder who wants to
-  // do real work FROM the box runs /builder-reauth, minting a normal cli/web session.
-  const scope = sessionScopeFor(session.source);
-  if (!scopeCovers(scope, req.sessionScopeNeeds)) {
-    res.fail('box_scope', {
+  // SECURITY: an UNDECLARED session source is denied (see the registry notes
+  // above). This is what keeps a token of a retired source out of every route, and
+  // any source added later out until the registry declares it.
+  if (!sessionScopeFor(session.source)) {
+    res.fail('session_scope', {
       status: 403,
-      message: scope
-        ? 'This is a box-scoped session; it may only call dev-box bootstrap endpoints.'
-        : 'This session carries an unrecognised scope and may not call authenticated endpoints.',
+      message: 'This session carries an unrecognised source and may not call authenticated endpoints. Sign in again to mint a normal session.',
     });
     return;
   }
@@ -382,9 +316,9 @@ function signInWithReturn(req) {
 //   1. IDENTITY  — is there a live session? (token from the gds_session cookie /
 //      legacy pms_session / Bearer, looked up fresh against builder_sessions).
 //      No → 302 into the web sign-in flow.
-//   2. SCOPE     — is a page inside this SESSION's scope at all? A narrowing scope
-//      (a box-baked token) reaches no page, whatever its builder's rank, exactly as
-//      requireBuilder denies it every route that declared nothing (task 1003197).
+//   2. SOURCE    — does the session-scope registry declare this session's source?
+//      An undeclared one reaches no page, whatever its builder's rank, exactly as
+//      requireBuilder denies it every route (task 1003197).
 //      No → 302 into the web sign-in flow: the remedy is a different session.
 //   3. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
 //      per request through the `governance` port exactly as requirePermission
@@ -557,21 +491,15 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
-  // SECURITY (task 1003197 (A)): SESSION-SCOPE, the same deny-by-default check
-  // requireBuilder runs above — the two auth paths must not diverge. resolveSession
-  // accepts a Bearer token with NO source filter, so before this a box-baked token
-  // could fetch a gated page SHELL (/builders, /watch, the tab shells) whenever its
-  // builder's rank held the page's permission. Every data endpoint underneath
-  // re-gates through requireBuilder and 403s box_scope, so the exposure was shells
-  // only — but a shell is still a surface a token living outside the ADR 0016 trust
-  // boundary was never meant to reach. Page routes declare no capability, so
-  // scopeCovers refuses EVERY narrowing scope here (and an unrecognised source with
-  // it), while an unscoped cli/web session passes untouched.
+  // SECURITY (task 1003197 (A)): the same undeclared-source check requireBuilder
+  // runs above — the two auth paths must not diverge. resolveSession accepts a
+  // Bearer token with NO source filter, so without this a token of an undeclared
+  // source could fetch a gated page SHELL whenever its builder's rank held the
+  // page's permission.
   //
   // Sign-in, not `deniedTo`: unlike the authority branch below, the remedy is a
-  // DIFFERENT SESSION — /builder-reauth mints a normal one — not a different page,
-  // and a box session has no browser cookie to loop the sign-in flow with.
-  if (!scopeCovers(sessionScopeFor(session.source), req.sessionScopeNeeds)) {
+  // DIFFERENT SESSION, not a different page.
+  if (!sessionScopeFor(session.source)) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
@@ -598,14 +526,14 @@ async function runPageGate(name, req, res, next) {
 }
 
 // The authenticated /builders HTML surface — the Work Board, Roadmap, Goals, the
-// task-detail page, the Repo Atlas, the Dev Box pair page and Settings. A Xenos IS
+// task-detail page, the Repo Atlas and Settings. A Xenos IS
 // allowed (page.view.public floors at xenos); an unauthenticated visitor is bounced
 // into sign-in rather than served the page shell.
 async function requireBuilderPage(req, res, next) {
   return runPageGate('requireBuilderPage', req, res, next);
 }
 
-// The /watch monitoring surface, the /harbor dev-box page and the /gate page
+// The /watch monitoring surface and the /gate page
 // (#726, idea 257, task 1179) — Metic and up, per `page.view.government`'s catalog
 // floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
 // (older ADRs still use the old name; this line is the trail). Defense-in-depth:
@@ -917,10 +845,7 @@ module.exports = {
   extractTokens,
   SESSION_COOKIE_NAMES,
   resolveSession,
-  allowBoxScope,
-  sessionScope,
   sessionScopeFor,
-  sessionScopeAdmits,
   parseSessionScopes,
   SESSION_SCOPES,
   requireBuilder,

package/src/bongos/db-kernel.js

@@ -45,7 +45,7 @@ async function withTx(fn, { pool: p = pool } = {}) {
 }
 
 // getBuilderById — the canonical builder-identity read (id, rank, status, the
-// economy counters, box-block state). The kernel's identity primitive; auth and
+// economy counters). The kernel's identity primitive; auth and
 // every rank gate ultimately resolve a builder through this shape.
 async function getBuilderById(id) {
   // karma was added in migration 040 (V3.R24 / #244) as a separate
@@ -55,8 +55,7 @@ async function getBuilderById(id) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, total_credits, karma, created_at, rank,
             status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, system_role,
-            anthropic_email, anthropic_user_id, monthly_budget_usd,
-            box_blocked, box_blocked_reason, box_blocked_at, box_blocked_by
+            anthropic_email, anthropic_user_id, monthly_budget_usd
        FROM builders WHERE id = $1`,
     [id]
   );

package/src/bongos/db.js

@@ -26,10 +26,9 @@
 
 const { pool } = require('./pool');
 const secretBox = require('./secret-box');
-// Module seam (ADR 0083 / BV1.R43). The rank/status-change paths EMIT
-// `builder.box-reconcile-needed` AFTER COMMIT (best-effort) so the dev-box module
-// can reconcile a droplet a demotion/graduation implies — never a direct require
-// of the module.
+// Module seam (ADR 0083). The builder-exit path EMITS `builder.secrets-scrub-needed`
+// AFTER COMMIT (best-effort) so a module that stores a builder-keyed secret can
+// clear its own store — never a direct require of the module.
 const seams = require('../module-seams');
 
 // Kernel db slice (BV1.R69 / ADR 0091 §2): builder IDENTITY (getBuilderById),
@@ -123,11 +122,6 @@ async function linkAnthropicAccount(builderId, { email, userId }) {
 // setBuilderMonthlyBudget() carved into modules/economy/cost.js (BV1.R77 / ADR
 // 0093 §1-2). routes/builders.js resolves it via the `reward` kernel port.
 
-// setBuilderBoxBlocked + its box_blocked UPDATE RELOCATED to modules/dev-box/db.js
-// (BV1.R68 / ADR 0091 §3): box-blocked is cleanly dev-box-owned — the module is
-// its only writer AND reader (core never reads box_blocked) — so the query left
-// the core monolith with the doorway re-export when the slice pattern landed.
-
 // Approval-gated entry (2026-05-30). The web hall sign-in no longer auto-creates
 // an account for any GitHub user — a first-time visitor must be approved first
 // (an Archon marks their access_request 'invited'). These three small lookups
@@ -446,14 +440,6 @@ async function setBuilderRank({ builderId, newRank, actorBuilderId }) {
   const result = await withTx(async (client) => {
     return _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, enforceSingleRungPromotion: true });
   });
-  // Source-access clawback (ADR 0031 §6 / #600). Post-commit, own connection,
-  // never throws — records the box reconcile this rank change implies (a demotion
-  // below the floor → deprovision; a graduation up → rescope). The CREDENTIAL
-  // layer is already cut off live on the next /box/source-access fetch; this
-  // just signals + audits the slower droplet-level reconcile.
-  await seams.emitAsync('builder.box-reconcile-needed', {
-    builderId, rank: newRank, status: result.status, actor: `rank-change:builder#${actorBuilderId}`,
-  });
   return {
     builder: result.builder,
     previous_rank: result.previous_rank,
@@ -613,20 +599,11 @@ async function deactivateBuilder({ builderId, reason, actorBuilderId }) {
     await deleteGithubToken({ builderId, p: client });
     return { updated, activeClaims };
   });
-  // Source-access clawback (ADR 0031 §6 / #600): a deactivated builder loses
-  // their box → loses source. Post-commit, own connection, never throws. The
-  // builder is now status='inactive' (rank forced to xenos above), so the
-  // reconcile resolves to 'deprovision'. Their next /box/source-access fetch is
-  // already 403'd (inactive) — this signals the droplet teardown for `box.js
-  // reconcile` / the dormant sweep.
-  await seams.emitAsync('builder.box-reconcile-needed', {
-    builderId, rank: 'xenos', status: 'inactive', actor: `builder-exit:builder#${actorBuilderId}`,
-  });
   // PRIVACY (task 1003338 / ADR 0332): teardown port for a MODULE-owned
   // builder-keyed secret (today: art-pipeline's Gemini BYOK key,
   // gemini_key_enc/last4/set_at — CRUD moved out of core under ADR 0102, so
-  // core does not touch those columns directly). Best-effort, same as
-  // box-reconcile-needed above: a module that stores such a secret listens
+  // core does not touch those columns directly). Best-effort, post-commit:
+  // a module that stores such a secret listens
   // for this event and clears its own store; on a vanilla instance (no
   // listener registered) it is a no-op.
   await seams.emitAsync('builder.secrets-scrub-needed', {

package/src/bongos/module-scope-map.js

@@ -20,7 +20,7 @@
 // regex, so wildcards would never match. Every PROTECTED_GLOBS entry is likewise
 // an exact path or dir-prefix, so the overlap is exact.
 //
-// FIRST CUT, auto-tightening. We are mid-strangler (ADR 0083): only dev-box has
+// FIRST CUT, auto-tightening. We are mid-strangler (ADR 0083): some domains have
 // moved into modules/<key>/; the rest still live fused in src/bongos/. So a module's
 // globs list WHERE ITS CODE LIVES TODAY plus its modules/<key>/ home, and the
 // `protected` result reflects the current tree (most core domains are protected
@@ -30,7 +30,7 @@
 // modules + kernel from docs/design/modular-architecture/02-module-map.md §6.
 //
 // RELATION to src/modules.js: that registry tracks only the OPTIONAL feature
-// modules (game/art-pipeline/discord/dev-box) an instance toggles. This map is a
+// modules (game/art-pipeline/discord) an instance toggles. This map is a
 // SUPERSET — every module including the always-on core domains — because the goal
 // scope wall must place ALL work, not just the optional features.
 
@@ -316,7 +316,7 @@ const MODULE_GLOBS = {
   //     (files-are-source — the committed definitions ARE the input agents-sync
   //     upserts), listed alongside it on the autonomy precedent, which likewise
   //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
-  //     with the domain but stays under scripts/gds/ (the dev-box/provisioning
+  //     with the domain but stays under scripts/gds/ (the provisioning
   //     precedent). Without this key the three Agents goals (1000038/39/40) could
   //     declare no wall at all (task 1002736).
   agents: [
@@ -342,7 +342,7 @@ const MODULE_GLOBS = {
   'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
-  //     lifecycle/dev-box precedent). Covers the projects-surface work (goal
+  //     lifecycle precedent). Covers the projects-surface work (goal
   //     1000059); previously NO key resolved these paths, so no goal could wall
   //     them (task 1002690). ---
   provisioning: [
@@ -355,32 +355,17 @@ const MODULE_GLOBS = {
     // core/CLI-side under scripts/discord/.
     'scripts/discord/', 'modules/discord/',
   ],
-  // --- per-builder cloud dev boxes (DO droplets + Cloudflare tunnels), the sandbox
-  //     preview, server-mediated branch publish. First module carved to modules/dev-box/
-  //     (BV1.R43 — ADR 0083). Like the lifecycle/onboarding CLIs, the dev-box OPERATOR +
-  //     connect commands travel with the domain but stay under scripts/gds/: box.js (the
-  //     DO/CF provisioning control plane), box-auth-check, box-connect-lib, and the box
-  //     smoke test. Listing them here so a `dev-box`-scoped goal's wall covers the box
-  //     provisioning / bring-up work (BV1.R91, goal 1000051 C2), not just modules/dev-box/.
-  //     The box BRING-UP scripts (infra/box-*.sh — box-source-fetch, heartbeat, terminal
-  //     units) are INSTANCE-VENDORED (ADR 0144; not tracked in core), so they are not
-  //     listed here yet — they come under this key when de-vendored. (ADR 0150 /
-  //     task 1002386 made box.js RESOLVE infra/ from the instance root and fail
-  //     loudly when it is missing; de-vendoring infra/ into core is still open.)
-  'dev-box': [
-    'modules/dev-box/', 'devbox-app/',
-    'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
-    'scripts/gds/smoke-box.sh',
-    'scripts/gds/box-sync.js', // task 1004024: split out of box.js, now protected
-  
-    // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
-    // orchestrates these five provisioning CLIs, and infra/ is the shell-script
-    // tree it resolves from the instance root — the comment above has described
-    // infra/ as dev-box's since task 1002386 without the glob saying so.
+  // --- the operator CONTROL PLANE: the provisioning CLIs that hold the DigitalOcean /
+  //     Cloudflare credentials, and an instance's host topology under infra/. Not a
+  //     module (nothing under modules/ carries it) — a scope like kernel or devsecops.
+  //     Its own key rather than provisioning's, deliberately: every path here is a
+  //     PROTECTED surface, so listing them under provisioning would make that module
+  //     derive protected:true and put its open goals (1000106) behind an Archon join —
+  //     the effect tests/government_protected_surfaces.mjs pins against. Given this key
+  //     by task 1003892 (their previous owner was retired).
+  'control-plane': [
     'scripts/gds/provision-config.js',
     'scripts/gds/provision-net.js',
-    'scripts/gds/box-infra.js',
-    'scripts/gds/cf-tunnel.js',
     'scripts/gds/do-api.js',
     'infra/',
   ],
@@ -709,7 +694,7 @@ function scopeIncludesProtected(keys) {
 //
 // WHAT THIS IS AND IS NOT FOR. This narrows ONE consumer: the ship-time module-
 // drift advisory (moduleDriftFiles below), whose question is "you said game, did
-// you touch dev-box?" — module-to-module confusion. It does NOT touch the goal
+// you touch discord?" — module-to-module confusion. It does NOT touch the goal
 // scope wall, claim collisions (touchesOverlap), or the protected-path wall.
 // Those keep counting methodology's territory as methodology's.
 //

package/src/bongos/module-store.js

@@ -0,0 +1,141 @@
+// src/bongos/module-store.js — the module store's write side: keep a published
+// module version's tarball and record it in the registry (task 1004271, ADR 0338 D1).
+//
+// The route (POST /store/modules/:key/versions in routes/modules.js) verifies the
+// upload with scripts/gds/module-artifact.js first; this file only persists what has
+// already passed. Two halves, in this order:
+//
+//   1. stageArtifact — write the tarball under the store dir (a temp name first;
+//      commitArtifact moves it into place inside step 2's transaction). ADR 0338 lets the
+//      store keep tarballs on the control plane's disk while volume is small, so it
+//      does: <MODULE_STORE_DIR or var/module-store>/<key>/<key>-<version>.tgz. Outside
+//      the git tree, like var/task-visuals, so a deploy's `git reset --hard` never
+//      wipes it.
+//   2. publishVersion — one transaction over the registry tables (core_257): create
+//      the store_modules row on a key's first publish (the publisher becomes its
+//      author), refuse anyone else's key, refuse a delisted key (ADR 0338 D2: delisting
+//      stops what comes next), refuse a version that already exists or is not newer
+//      than the latest, then INSERT the version row. Rows are only ever INSERTed.
+//
+// If step 2 refuses, the route removes the temp file step 1 wrote, so a refused
+// publish leaves nothing behind.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { parseVersion, cmp } = require('../module-loader/semver');
+const { KEY_RE } = require('../module-loader/manifest-schema');
+
+
+function storeDir() {
+  return process.env.MODULE_STORE_DIR || path.join(__dirname, '..', '..', 'var', 'module-store');
+}
+
+// Where one version's tarball lives. Key and version are re-validated here so this
+// is the path-traversal defense on its own, whatever the caller checked.
+function artifactPath(key, version, { dir = storeDir() } = {}) {
+  if (!KEY_RE.test(String(key)) || !parseVersion(String(version))) {
+    throw new Error('artifactPath: a bad module key or version');
+  }
+  return path.join(dir, key, `${key}-${version}.tgz`);
+}
+
+// Write the tarball to a private temp name beside its final place and return both
+// paths. It becomes the real file only through commitArtifact, which publishVersion
+// runs just before COMMIT — so a crash anywhere leaves at most a temp file (or a
+// final file with no row, which the next publish of that version simply replaces),
+// never a row pointing at nothing and never a stray file that blocks a retry.
+// Async throughout so a multi-MB write never holds the web process's event loop.
+async function stageArtifact(buf, { key, version, dir = storeDir() } = {}) {
+  const final = artifactPath(key, version, { dir });
+  await fs.promises.mkdir(path.dirname(final), { recursive: true });
+  const tmp = `${final}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.partial`;
+  await fs.promises.writeFile(tmp, buf, { flag: 'wx', mode: 0o640 });
+  return { tmp, final };
+}
+
+async function commitArtifact({ tmp, final }) {
+  await fs.promises.rename(tmp, final);
+}
+
+async function removeArtifact(file) {
+  try { await fs.promises.unlink(file); } catch { /* already gone — nothing to undo */ }
+}
+
+// The store keeps artifact_path relative to the store dir, so moving the dir (or
+// moving to object storage later) is a config change, not a data migration.
+function relativeArtifactPath(file, { dir = storeDir() } = {}) {
+  return path.relative(dir, file).split(path.sep).join('/');
+}
+
+// One transaction. `db` is a pg Pool (anything with connect()). Returns
+// { ok: true, version: row, created: bool } or { ok: false, code, message, status }.
+async function publishVersion(input, { db, beforeCommit } = {}) {
+  const {
+    key, title, description, version, coreVersion, manifest,
+    treeSha256, tarballSha256, bytes, artifactPath: relPath, builderId,
+  } = input;
+  const pool = db || require('./pool').pool;
+  const client = await pool.connect();
+  const refuse = async (status, code, message) => {
+    await client.query('ROLLBACK');
+    return { ok: false, status, code, message };
+  };
+  try {
+    await client.query('BEGIN');
+    const { rows: [mod] } = await client.query(
+      'SELECT module_key, author_id, status FROM store_modules WHERE module_key = $1 FOR UPDATE', [key]);
+    let created = false;
+    if (!mod) {
+      await client.query(
+        'INSERT INTO store_modules (module_key, title, description, author_id) VALUES ($1, $2, $3, $4)',
+        [key, title, description || '', builderId]);
+      created = true;
+    } else {
+      if (String(mod.author_id) !== String(builderId)) {
+        return refuse(403, 'not_module_author', `"${key}" belongs to another author — only its author can publish new versions`);
+      }
+      if (mod.status === 'delisted') {
+        return refuse(409, 'module_delisted', `"${key}" is delisted — it takes no new versions (ADR 0338 D2)`);
+      }
+    }
+
+    // Every version of the key, compared in JS: semver order is numeric per part, so
+    // a text ORDER BY would rank 1.10.0 below 1.9.0. A module's version count is small.
+    const { rows: existing } = await client.query(
+      'SELECT version FROM store_module_versions WHERE module_key = $1', [key]);
+    const wanted = parseVersion(version);
+    if (existing.some((r) => r.version === version)) {
+      return refuse(409, 'version_exists', `${key} ${version} is already published — a version never changes; bump module.json's version`);
+    }
+    const newest = existing.map((r) => parseVersion(r.version)).filter(Boolean).sort(cmp).pop();
+    if (newest && cmp(wanted, newest) <= 0) {
+      return refuse(409, 'version_not_newer', `${key} ${version} is not newer than the latest published ${newest.join('.')}`);
+    }
+
+    const { rows: [row] } = await client.query(
+      `INSERT INTO store_module_versions
+         (module_key, version, core_version, manifest, tree_sha256, tarball_sha256,
+          tarball_bytes, artifact_path, published_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+       RETURNING id, module_key, version, core_version, tree_sha256, tarball_sha256,
+                 tarball_bytes, published_by, published_at`,
+      [key, version, coreVersion, manifest, treeSha256, tarballSha256, bytes, relPath, builderId]);
+    // Put the tarball in place while the row is still uncommitted: if this throws,
+    // the catch below rolls the row back, so the two can never disagree.
+    if (beforeCommit) await beforeCommit();
+    await client.query('COMMIT');
+    return { ok: true, created, version: row };
+  } catch (e) {
+    try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
+    // Two publishes of the same version racing past the check: the UNIQUE wins.
+    if (e && e.code === '23505') return { ok: false, status: 409, code: 'version_exists', message: `${key} ${version} is already published` };
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+module.exports = {
+  stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
+};